Privacy Policy

1. Introduction

Protecting your personal data is a priority for Seonsaengnim. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR).

Data Controller:
XOXO Inc.
Address: 3F, 24, Dongmak-ro 15-gil, Mapo-gu, Seoul, South Korea
Email: nicolas@seonsaengnim.com

2. Data Collected

We collect the following personal data:

• Identification data : Name, surname, email address, username
• Connection data : IP address, connection logs, browsing data
• Payment data : Billing information (processed by Stripe through XOXO Commerce Inc., our authorized payment agent — we do not store your banking data)
• Usage data : Progress in lessons, exercise results, vocabulary learned, learning statistics
• Communication data : Messages sent via the automated learning assistant, support requests, bug reports

3. Processing Purposes

Your personal data is collected and processed for the following purposes:

• Creation and management of your user account
• Provision of Korean learning services
• Subscription and payment management
• Personalization of your learning experience
• Tracking your progress and generating statistics
• Communication with you (support, notifications, updates)
• Improvement of our services and development of new features
• Compliance with our legal and regulatory obligations

4. Legal Basis for Processing

The processing of your personal data is based on the following legal grounds:

• Contract execution : For the provision of services you have subscribed to
• Consent : For sending marketing communications (you can withdraw your consent at any time)
• Legitimate interest : For improving our services and platform security
• Legal obligation : For compliance with our accounting and tax obligations

5. Data Recipients

Your personal data may be shared with:

• Service providers : Stripe, Inc. (payment processing through our agent XOXO Commerce Inc.), Vercel (hosting), Supabase (database), OpenAI (processing services), PostHog, Inc. (product usage analytics)
• Competent authorities : In case of legal obligation or judicial request

We ensure that all our service providers comply with GDPR and offer sufficient guarantees for data protection.

As part of payment processing, certain billing data (name, email, amount) is shared with XOXO Commerce Inc. (USA), our authorized payment agent, and with Stripe, Inc. (USA) acting as the payment processor. These transfers to the United States are governed by the European Commission's standard contractual clauses.

Usage analytics (PostHog)

We use PostHog to analyze usage of the website and the iOS and Android mobile apps (page views, product events). Once you are signed in, this data may be linked to your account (user ID, email address). It is used to understand and improve the product. It is not used for cross-app advertising or advertising tracking via advertising identifiers (IDFA / GAID). PostHog acts as a processor; its privacy policy is available at https://posthog.com/privacy.

6. Data Transfers Outside the EU

Some of our service providers (Vercel, OpenAI, PostHog) may be located outside the European Union. In this case, we ensure that appropriate safeguards are in place (European Commission standard contractual clauses, Privacy Shield, etc.).

7. Data Retention

Your personal data is retained for the following periods:

• Account data : For the duration of your active account, then 3 years after the last login
• Payment data : 10 years in accordance with accounting obligations
• Progress data : For the duration of your active account

At the end of these periods, your data is deleted or irreversibly anonymized.

8. Your Rights

In accordance with GDPR, you have the following rights:

• Right of access : Obtain a copy of your personal data
• Right to rectification : Correct your inaccurate or incomplete data
• Right to erasure : Request deletion of your data (under certain conditions)
• Right to restriction : Restrict the processing of your data
• Right to portability : Receive your data in a structured and readable format
• Right to object : Object to the processing of your data
• Right to withdraw consent : At any time, without affecting the lawfulness of processing based on consent before withdrawal

To exercise your rights, contact us at nicolas@seonsaengnim.com with a copy of your ID. We will respond within one month.

You also have the right to lodge a complaint with your local data protection authority.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data in the database
• Secure authentication and access management
• Regular backups
• Security incident monitoring and detection

10. Cookies

Our site uses cookies to improve your experience. For more information, see our Cookie Policy.

11. Changes

We reserve the right to modify this Privacy Policy at any time. Changes take effect upon publication on the site. We encourage you to check this page regularly.

12. Contact

For any questions regarding this Privacy Policy or the exercise of your rights:
Email: nicolas@seonsaengnim.com
Address: 3F, 24, Dongmak-ro 15-gil, Mapo-gu, Seoul, South Korea